1

Annex 1

Comparative table of proposed amendments to the AML Rules (AIFC RULES NO. FR0008 OF 2017)

№ Provisions of Rules (active version) Proposed provisions of Rules Notes

1. INTRODUCTION

1.1. Overview of the AML Rules

1 P 1.1. (a): The Anti-Money Laundering ("AML") Rules are made in recognition of the application of the Law of the Republic of Kazakhstan No 191-IV dated 28 August 2009 on counteracting legalisation (laundering) of proceeds obtained through criminal means and financing of terrorism (the "AML Law"), the Criminal Code of the Republic of Kazakhstan No 226-5 dated 3 July 2014 (the "Criminal Code"), the Code on Administrative Offences of the Republic of Kazakhstan No 235-V dated 5 July 2014 (the "Administrative Code") and international conventions and treaties ratified by the Republic of Kazakhstan.

P 1.1. (a): The Anti-Money Laundering ("AML") Rules are made in recognition of the application of the Law of the Republic of Kazakhstan No 191-IV dated 28 August 2009 on counteracting legalisation (laundering) of proceeds obtained through criminal means and financing of terrorism (the "AML Law"), the Criminal Code of the Republic of Kazakhstan No 226-5 dated 3 July 2014 (the "Criminal Code") and international conventions and treaties ratified by the Republic of Kazakhstan.

“The Code on Administrative Offences of the Republic of Kazakhstan No 235-V dated 5 July 2014 (the "Administrative Code")” was deleted as the article 214 “Breach of the legislation of the Republic of Kazakhstan on counteraction to legalization (laundering) of incomes received by criminal means, and financing of terrorism” of the Administrative Code are not applicable within AIFC. The AFSA view is that the cases of the breach of AML Rules or AML Law by the AIFC Participants should not be considered by the administrative courts of the Republic of Kazakhstan, the cases, according to the AIFC regulations, will be held by the AFSA courts.

2

“ Article 214. Breach of the legislation of the Republic of Kazakhstan on counteraction to legalization (laundering) of incomes received by criminal means, and financing of terrorism

1. Breach of the legislation of the Republic of Kazakhstan on counteraction to legalization (laundering) of incomes received by criminal means and financing of terrorism by subjects of financial monitoring in a part of documentary fixing, storage and provision of information on operations subjected to financial monitoring, their clients, proper inspection of clients (their representatives) and beneficiary owners, suspension and refusal from conduct of the operations subjected to financial monitoring, protection of documents, received in a process of own activity, shall – entail a fine on individuals in amount of one hundred, on authorised persons, notary officers and advocates, subjects of small entrepreneurship or non-profit organizations – in amount of one hundred forty, on subjects of medium entrepreneurship – in amount of two hundred twenty, on subject of large

3

entrepreneurship – in amount of four hundred monthly calculation indices. 2. Non-fulfilment of the obligations by subjects of financial monitoring on development, acceptance and (or) execution of the rules of internal control and programs of its carrying out, shall – entail a fine on individuals in amount of one hundred, on authorised persons, notary officers and advocates, subjects of small entrepreneurship or non-profit organizations – in amount of one hundred sixty, on subjects of medium entrepreneurship – in amount of two hundred fifty, on subject of large entrepreneurship – in amount of nine hundred monthly calculation indices. 3. Notification of own clients and other persons on information provided to the authorized body on financial monitoring by authorised persons of the subjects of financial monitoring, shall – entail a fine in amount of one hundred fifty monthly calculation indices. 3. Actions (omission) provided by parts one, two and three of this Article, committed repeatedly second time second time within a year after imposition of administrative sanction, shall –

4

entail a fine on individuals in amount of one hundred fifty, on authorised persons, notary officers and advocates, subjects of small entrepreneurship or non-profit organizations – in amount of one hundred eighty, on subjects of medium entrepreneurship – in amount of three hundred, on subjects of large entrepreneurship – in amount of one thousand two hundred monthly calculation indices. 5. Actions (omission) provided by parts one, two and three of this Article committed three and more times within a year after imposition of administrative sanction, shall – entail a fine on individuals – in amount of two hundred, on authorised persons, advocates, notary officers, individual entrepreneurs – in amount of four hundred, on commodity exchanges, legal entities carrying out entrepreneurial activity in the scope of rendering of accounting services, microfinance organizations, operators of electronic money systems that are not the banks, organizers of gambling industry and lotteries, postal operators, audit organizations – in amount of two thousand monthly calculation indices, with suspension of the license validity term for particular

5

type of activity or with temporary suspension of qualification testimony (certificate) for the term up to six months or their deprivation or suspension of activity of a legal entity for the term up to three months.

”

1.6. Interpretation

2 - P 1.6. Interpretation Words and expressions used in these Rules are set out in the Astana International Financial Centre Glossary.

The paragraph about words and expressions interpretation was added in order to clarify the definitions’ location.

3.1. Kazakhstan criminal law

3 P 3.1. (b): Under Article 218 of the Criminal Code, a Person is criminally liable for the offence of money laundering if they knowingly receive, convert, conceal, possess, or use property representing the proceeds of criminal or administrative infractions of the law of Kazakhstan. The offence may be punished by a custodial sentence, confiscation of assets, and/or a fine.

- The reference to the article of Criminal Code was removed. All the precise references to the provisions of the external regulatory acts will be covered in the AIFC AML/CTF Guidelines the approval of which is scheduled for IV quarter of 2018. The purpose of this is to not make AIFC AML Rules dependent on the constant changes of Kazakh domestic regulatory acts.

4.1.3. Obligation to conduct business and customer risk assessment

4 P 4.1.3.: In order to identify and assess the risks of money laundering and terrorist financing a Relevant Person must

P 4.1.3.: In order to identify and assess the risks of money laundering and terrorist financing a Relevant Person must

The first sentence was expanded in compliance with the FATF recommendation 1 and Interpretive Note to Recommendation 1.

6

conduct a business risk assessment and must also conduct customer risk assessments in accordance with Chapter 5.

conduct a business risk assessment and must also conduct customer risk assessments in accordance with Chapter 5 and keep these assessments up to date. The risks of money laundering and terrorist financing that may arise in relation to the development of new products and new business practices, including new delivery mechanisms, and the use of new or developing technologies for both new and pre-existing products must be identified and assessed by a Relevant Person prior to the launch or use of such products, practices and technologies.

“ INTERPRETIVE NOTE TO RECOMMENDATION 1 Assessing risk - Financial institutions and DNFBPs should be required to take appropriate steps to identify and assess their money laundering and terrorist financing risks (for customers, countries or geographic areas; and products, services, transactions or delivery channels). They should document those assessments in order to be able to demonstrate their basis, keep these assessments up to date, and have appropriate mechanisms to provide risk assessment information to competent authorities and SRBs. The nature and extent of any assessment of money laundering and terrorist financing risks should be appropriate to the nature and size of the business. Financial institutions and DNFBPs should always understand their money laundering and terrorist financing risks, but competent authorities or SRBs may determine that individual documented risk assessments are not required, if the specific risks inherent to the sector are clearly identified and understood. ”

7

The last sentence was added into P 4.1.3. in compliance with the requirement prescribed by FATF Recommendation 15. “ 15. New technologies Countries and financial institutions should identify and assess the money laundering or terrorist financing risks that may arise in relation to (a) the development of new products and new business practices, including new delivery mechanisms, and (b) the use of new or developing technologies for both new and pre-existing products. In the case of financial institutions, such a risk assessment should take place prior to the launch of the new products, business practices or the use of new or developing technologies. They should take appropriate measures to manage and mitigate those risks. ”

4.3.1. Requirements of policies, controls and procedures

5 P 4.3.1.: The policies, controls and procedures adopted by a Relevant Person under AML 4.1.1 must be: (a) proportionate to the nature, scale and complexity of the activities of the Relevant Person’s business;

P 4.3.1.: The policies, controls and procedures adopted by a Relevant Person under AML 4.1.1 must be: (a) proportionate to the nature, scale and complexity of the activities of the Relevant Person’s business;

The clause “be comprised of, at minimum, organisation of the development and maintenance of the policies, procedures, systems and controls required by AML 4.1.1, risk management, customer identification, transaction monitoring and studying,

8

(b) approved by its senior management; and (c) monitored, reviewed and updated regularly.

(b) comprised of, at minimum, organisation of the development and maintenance of the policies, procedures, systems and controls required by AML 4.1.1, risk management, customer identification, transaction monitoring and studying, employees training and awareness programs; (c) approved by its senior management; and (d) monitored, reviewed and updated regularly.

employees training and awareness programs” was added in compliance and for the consistency with the paragraph 3 of the Article 11 of AML Law. “ Article 11. Maintenance of internal control by subjects of financial monitoring … 3. Rules of internal control shall be developed, accepted and executed by subjects of financial monitoring, and besides the requirements to the activity of a subject of financial monitoring upon conduct of internal control provided by this Law, shall include: program of organizing internal control for the purpose of counteraction of legitimization (laundering) of incomes received by illegal means, and financing of terrorism; program of risk management of legitimization (laundering) of incomes received by illegal means, and financing of terrorism, considering the risks of clients and risks of using the services in criminal purposes, including the risk of using the technological achievements; identification program of clients; monitoring program and study of transactions of clients including study of

9

difficult, unusual big and other unusual transactions of clients; program of training and study of employees of subjects of financial monitoring on the issues of counteraction of legitimization (laundering) of incomes received by illegal means, and financing of terrorism; other programs that may be developed by subjects of financial monitoring in accordance with the rules of internal control. ”

5.1.3. Conduct of the customer risk assessment

6 P 5.1.3. (a): identify the customer and any beneficial owner(s);

P 5.1.3. (a): identify the customer, any beneficial owner(s) and any person acting on behalf of a customer;

The clause was expanded in compliance with the identification requirement of the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (4). “ Interpretive Note to Recommendation 10 … B. CDD – Persons acting on behalf of a customer When performing elements (a) and

(b) of the CDD measures specified

under Recommendation 10, financial

institutions should also be required to

verify that any person purporting to act

on behalf of the customer is so authorised,

10

and should identify and verify the identity

of that person.

” 7 P 5.1.3. (g):

consider the outputs of the business risk assessment under Chapter 5.

P 5.1.3. (g): consider the beneficiary of a life insurance policy, where applicable; and P 5.1.3. (h): consider the outputs of the business risk assessment under Chapter 5.

The clause was added in compliance with the identification requirement of the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (6). “ Interpretive Note to Recommendation 10 … For life or other investment-related insurance business, financial institutions should, in addition to the CDD measures required for the customer and the beneficial owner, conduct the following CDD measures on the beneficiary(ies) of life insurance and other investment related insurance policies, as soon as the beneficiary(ies) are identified/designated: (a) For beneficiary(ies) that are identified as specifically named natural or legal persons or legal arrangements – taking the name of the person; (b) For beneficiary(ies) that are designated by characteristics or by class (e.g. spouse or children at the time that the insured event occurs) or by other means (e.g. under a will) – obtaining sufficient information concerning the beneficiary to satisfy the financial

11

institution that it will be able to establish the identity of the beneficiary at the time of the payout. ” The littera of the numbered list of the following clause was changed to (h).

6.1.2. Undertaking Simplified Due Diligence

8 P 6.1.2.: A Relevant Person may undertake SDD in accordance with AML 8.1.1 by modifying the CDD under AML 6.3.1 for any customer it has assigned as low risk.

P 6.1.2.: A Relevant Person may undertake SDD in accordance with AML 8.1.1 by modifying the CDD under AML 6.3.1 for any customer it has assigned as low risk. Simplified measures should not be conducted whenever there is a suspicion of money laundering and/or terrorist financing.

The last sentence was added into P 6.1.2. in compliance with the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (21). “ Interpretive Note to Recommendation 10 … Where the risks of money laundering or terrorist financing are lower, financial institutions could be allowed to conduct simplified CDD measures, which should take into account the nature of the lower risk. The simplified measures should be commensurate with the lower risk factors (e.g. the simplified measures could relate only to customer acceptance measures or to aspects of ongoing monitoring). Examples of possible measures are: ▪ Verifying the identity of the customer and the beneficial owner after the establishment of the business relationship (e.g. if account transactions

12

rise above a defined monetary threshold). ▪ Reducing the frequency of customer identification updates. ▪ Reducing the degree of on-going monitoring and scrutinising transactions, based on a reasonable monetary threshold. ▪ Not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring the purpose and nature from the type of transactions or business relationship established. Simplified CDD measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply. ”

6.2.3. Establishing a business relationship before Customer Due Diligence is complete

9 P 6.2.3.: A Relevant Person may establish a business relationship with a customer before completing the verification required by AML 6.3.1 if the following conditions are met:

(a) deferral of the verification of the customer or beneficial owner is necessary in order not to interrupt the

P 6.2.3.: A Relevant Person may establish a business relationship with a customer before completing the verification required by AML 6.3.1 if the following conditions are met:

(a) deferral of the verification of the customer or beneficial owner is necessary in order not to interrupt the

The clause on risk management procedures concerning the conditions under which a customer may utilise the business relationship prior to verification was added in compliance with the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (12). “ Interpretive Note to Recommendation 10

13

normal conduct of a business relationship;

(b) there is little risk of money laundering occurring and any such risks identified can be effectively managed by the Relevant Person; and

(c) in relation to a bank account opening, there are adequate safeguards in place to ensure that the account is not closed and transactions are not carried out by or on behalf of the account holder (including any payment from the account to the account holder) before verification has been completed;

(d) subject to (c), the relevant verification is completed as soon as reasonably practicable and in any event, no later than 30 days after the establishment of a business relationship.

normal conduct of a business relationship;

(b) risk management procedures concerning the conditions under which a customer may utilise the business relationship prior to verification have been adopted and are in place; and there is little risk of money laundering occurring and any such risks identified can be effectively managed by the Relevant Person;

(c) in relation to a bank account opening, there are adequate safeguards in place to ensure that the account is not closed and transactions are not carried out by or on behalf of the account holder (including any payment from the account to the account holder) before verification has been completed; and

(d) subject to (c), the relevant verification is completed as soon as reasonably practicable and in any event, no later than 30 days after the establishment of a business relationship.

… Financial institutions will also need to adopt risk management procedures with respect to the conditions under which a customer may utilise the business relationship prior to verification. These procedures should include a set of measures, such as a limitation of the number, types and/or amount of transactions that can be performed and the monitoring of large or complex transactions being carried out outside the expected norms for that type of relationship. ”

6.3. Undertaking Customer Due Diligence

14

6.3.1. Verification of obligations

10 P 6.3.1. (a): verify the identity of the customer and of any beneficial owner based on original or properly certified documents, data or information issued by or obtained from a reliable and independent source;

P 6.3.1. (a): verify the identity of the customer, any beneficial owner(s) and any person acting on behalf of a customer, including his authorisation to so act, based on original or properly certified documents, data or information issued by or obtained from a reliable and independent source;

The clause was expanded in compliance with the identification requirement of the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (4). “ Interpretive Note to Recommendation 10 … B. CDD – Persons acting on behalf of a customer When performing elements (a) and

(b) of the CDD measures specified

under Recommendation 10, financial

institutions should also be required to

verify that any person purporting to act

on behalf of the customer is so authorised,

and should identify and verify the identity

of that person.

”

11 P 6.3.1. (b, c, d): (b) understand the customer's sources of funds; (c) understand the customer's sources of wealth; and (d) undertake on-going due diligence of the customer business relationship under AML 6.4.1.

P 6.3.1. (b, c, d, e): (b) obtain information on the purpose and intended nature of the business relationship; (c) understand the customer's sources of funds; (d) understand the customer's sources of wealth; and

The clause on obtaining information on the purpose and intended nature of the business relationship was added in compliance with the FATF Recommendation 10. “ 10. Customer Due Diligence Financial institutions should be prohibited from keeping anonymous

15

(e) undertake on-going due diligence of the customer business relationship under AML 6.4.1.

accounts or accounts in obviously fictitious names. Financial institutions should be required to undertake customer due diligence (CDD) measures when: (i) establishing business relations; (ii) carrying out occasional transactions: (i) above the applicable designated threshold (USD/EUR 15,000); or (ii) that are wire transfers in the circumstances covered by the Interpretive Note to Recommendation 16; (iii) there is a suspicion of money laundering or terrorist financing; or (iv) the financial institution has doubts about the veracity or adequacy of previously obtained customer identification data. The principle that financial institutions should conduct CDD should be set out in law. Each country may determine how it imposes specific CDD obligations, either through law or enforceable means. The CDD measures to be taken are as follows: (a) Identifying the customer and verifying that customer’s identity using reliable, independent source documents, data or information. (b) Identifying the beneficial owner, and taking reasonable measures to verify the identity of the beneficial owner, such that the financial institution is satisfied that it

16

knows who the beneficial owner is. For legal persons and arrangements this should include financial institutions understanding the ownership and control structure of the customer. (c) Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship. (d) Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the institution’s knowledge of the customer, their business and risk profile, including, where necessary, the source of funds. Financial institutions should be required to apply each of the CDD measures under (a) to (d) above, but should determine the extent of such measures using a risk-based approach (RBA) in accordance with the Interpretive Notes to this Recommendation and to Recommendation 1. Financial institutions should be required to verify the identity of the customer and beneficial owner before or during the course of establishing a business relationship or conducting transactions for occasional customers. Countries may permit financial institutions to complete

17

the verification as soon as reasonably practicable following the establishment of the relationship, where the money laundering and terrorist financing risks are effectively managed and where this is essential not to interrupt the normal conduct of business. Where the financial institution is unable to comply with the applicable requirements under paragraphs (a) to (d) above (subject to appropriate modification of the extent of the measures on a risk-based approach), it should be required not to open the account, commence business relations or perform the transaction; or should be required to terminate the business relationship; and should consider making a suspicious transactions report in relation to the customer. These requirements should apply to all new customers, although financial institutions should also apply this Recommendation to existing customers on the basis of materiality and risk, and should conduct due diligence on such existing relationships at appropriate times. ”

18

6.3.2. Customer obligation for life insurance

12 - P 6.3.2. (c): if a beneficiary of the insurance policy who is a legal person or a legal arrangement presents a higher risk, take enhanced measures which should include reasonable measures to identify and verify the identity of the beneficial owner of the beneficiary, at the time of pay-out; and

The clause was added in compliance with the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (8). “ Interpretive Note to Recommendation 10 … The beneficiary of a life insurance policy should be included as a relevant risk factor by the financial institution in determining whether enhanced CDD measures are applicable. If the financial institution determines that a beneficiary who is a legal person or a legal arrangement presents a higher risk, then the enhanced CDD measures should include reasonable measures to identify and verify the identity of the beneficial owner of the beneficiary, at the time of payout. ”

13 - P 6.3.2. (d):

take reasonable measures to determine whether the beneficiaries of the insurance policy and/or, where required, the beneficial owner of the beneficiary, are PEPs, at the latest, at the time of the pay-out, and, in cases

The clause was added in compliance with the FATF Recommendation 12 and Interpretive Note to Recommendation 12. “ Interpretive Note to Recommendation 12

19

of higher risks, inform senior management before the pay-out of the policy proceeds, conduct enhanced scrutiny on the whole business relationship with the policyholder, and consider making a suspicious transaction report.

Financial institutions should take

reasonable measures to determine

whether the beneficiaries of a life

insurance policy and/or,where required,

the beneficial owner of the beneficiary

are politically exposed persons. This

should occur at the latest at the time of

the payout. Where there are higher risks

identified, in addition to performing

normal CDD measures, financial

institutions should be required to:

a) inform senior management before the

payout of the policy proceeds; and

b) conduct enhanced scrutiny on the

whole business relationship with the

policyholder, and consider making a

suspicious transaction report. ”

Guidance on undertaking Customer Due Diligence

14 (c) (vii): the identity of the directors, partners, trustees or equivalent persons with executive authority of the legal person; and

(c) (vii): the identity of the directors, partners, trustees or equivalent persons with executive authority of the legal person or who holds the position of senior managing official; and

The clause was expanded in compliance with the FATF Recommendation 10 and Interpretive Note to Recommendation 10 (5 (b (i.iii)). “ Interpretive Note to Recommendation 10 … (b) Identify the beneficial owners of the

customer and take reasonable measures

to verify the identity of such persons,

through the following information:

(i) For legal persons:

20

(i.i) The identity of the natural persons (if

any – as ownership interests can be so

diversified that there are no natural

persons (whether acting alone or

together) exercising control of the legal

person or arrangement through

ownership) who ultimately have a

controlling ownership interest in a legal

person; and

(i.ii) to the extent that there is doubt under

(i.i) as to whether the person(s) with the

controlling ownership interest are the

beneficial owner(s) or where no natural

person exerts control through ownership

interests, the identity of the natural

persons (if any) exercising control of the

legal person or arrangement through

other means.

(i.iii) Where no natural person is

identified under (i.i) or (i.ii) above,

financial institutions should identify and

take reasonable measures to verify the

identity of the relevant natural person

who holds the position of senior

managing official.

”

Guidance on identification and verification of beneficial owners

15 (e) For a retail investment fund, which is widely-held and where the investors invest via pension contributions, the manager of the fund is not expected to look through to underlying investors

(e) For a retail investment fund, which is widely-held and where the investors invest via pension contributions, the manager of the fund is not expected to look through to underlying investors

The last sentence was deleted since there is no waiver for any type of legal entity in their obligation to identify the beneficial owner(s).

21

where there are none with any material control or ownership levels in the fund. However, for a closely-held fund with a small number of investors, each with a large shareholding or other interest, a Relevant Person should identify and verify each of the beneficial owners, depending on the risks identified as part of its risk-based assessment of the customer. For a corporate health policy with defined benefits, a Relevant Person need not identify the beneficial owners.

where there are none with any material control or ownership levels in the fund. However, for a closely-held fund with a small number of investors, each with a large shareholding or other interest, a Relevant Person should identify and verify each of the beneficial owners, depending on the risks identified as part of its risk-based assessment of the customer.

According to the FATF Recommendation 10 (b) the CDD measures to be taken are as follows: Identifying the beneficial owner, and

taking reasonable measures to verify the

identity of the beneficial owner, such that

the financial institution is satisfied that it

knows who the beneficial owner is. For

legal persons and arrangements this

should include financial institutions

understanding the ownership and control

structure of the customer.

16 - (g) Where no natural person is identified as a beneficial owner, the relevant natural person who holds the position of senior managing official should be identified as such and verified.

The clause was added in compliance with the FATF Recommendation 10, Interpretive Note to Recommendation 10 (5 (b (i.iii)); and in compliance and for the consistency with the paragraph 3 of the Article 5 of AML Law. “ Interpretive Note to Recommendation 10 … (b) Identify the beneficial owners of the

customer and take reasonable measures

to verify the identity of such persons,

through the following information:

(i) For legal persons:

(i.i) The identity of the natural persons (if

any – as ownership interests can be so

diversified that there are no natural

persons (whether acting alone or

together) exercising control of the legal

22

person or arrangement through

ownership) who ultimately have a

controlling ownership interest in a legal

person; and

(i.ii) to the extent that there is doubt under

(i.i) as to whether the person(s) with the

controlling ownership interest are the

beneficial owner(s) or where no natural

person exerts control through ownership

interests, the identity of the natural

persons (if any) exercising control of the

legal person or arrangement through

other means.

(i.iii) Where no natural person is

identified under (i.i) or (i.ii) above,

financial institutions should identify and

take reasonable measures to verify the

identity of the relevant natural person

who holds the position of senior

managing official.

”

“

Article 5 of AML Law

…

In case if in result of taking measures provided by this subparagraph, the beneficial owner of a client-legal entity is not detected, the recognition of an individual executive body or a head of collegial executive body of the client-legal entity is allowed as the beneficial owner. …

”

23

6.6 Failure to conduct or complete Customer Due Diligence

6.6.1 Prohibitions

17 P 6.6.1.: Where, in relation to any customer, a Relevant Person is unable to conduct or complete the requisite CDD in accordance with AML 6.3.1 it must, to the extent relevant: (a) not carry out a transaction with or for the customer through a bank account or in cash; (b) not open an account or otherwise provide a service; (c) not otherwise establish a business relationship or carry out a transaction; (d) terminate or suspend any existing business relationship with the customer; (e) return any monies or assets received from the customer; and (f) consider whether the inability to conduct or complete Customer Due Diligence necessitates the making of a Suspicious Activity Report (see Chapter 13).

P 6.6.1.: Where, in relation to any customer, a Relevant Person is unable to conduct or complete the requisite CDD in accordance with AML 6.3.1 it must, to the extent relevant: (a) not carry out a transaction with or

for the customer through a bank account or in cash;

(b) not open an account or otherwise provide a service;

(c) not otherwise establish a business relationship or carry out a transaction;

(d) terminate or suspend any existing business relationship with the customer;

(e) return any monies or assets received from the customer; and

(f) consider whether the inability to conduct or complete Customer Due Diligence necessitates the making of a Suspicious Activity Report (see Chapter 13).

A Relevant Person is prohibited from knowingly keeping anonymous accounts

The last sentence was added into P 6.6.1. in compliance with FATF Recommendation 10. “ 10.Customer due diligence Financial institutions should be prohibited from keeping anonymous accounts or accounts in obviously fictitious names. ”

24

or accounts in obviously fictitious names.

12.1. Relevant United Nations resolutions and sanctions

12.1.1. Sanctions systems and controls

18 P 12.1.1.: A Relevant Person must establish and maintain effective systems and controls to ensure that on an on-going basis it is properly informed as to, and takes reasonable measures to comply with, relevant resolutions or sanctions issued by the United Nations Security Council or by the Republic of Kazakhstan

P 12.1.1.: A Relevant Person must establish and maintain effective systems and controls to ensure that on an on-going basis it is properly informed as to, and takes reasonable measures to comply with, relevant resolutions or sanctions issued by the United Nations Security Council or by the Republic of Kazakhstan. A Relevant Person must freeze without delay and without prior notice, the funds or other assets of designated persons and entities pursuant to relevant resolutions or sanctions issued by the United Nations Security Council or by the Republic of Kazakhstan.

The last sentence was added into P 12.1.1. in compliance with the FATF Recommendation 6 and Interpretive Note to Recomendation 6 (6). “ 6. Targeted financial sanctions related to terrorism and terrorist financing Countries should implement targeted financial sanctions regimes to comply with United Nations Security Council resolutions relating to the prevention and suppression of terrorism and terrorist financing. The resolutions require countries to freeze without delay the funds or other assets of, and to ensure that no funds or other assets are made available, directly or indirectly, to or for the benefit of, any person or entity either (i) designated by, or under the authority of, the United Nations Security Council under Chapter VII of the Charter of the United Nations, including in accordance with resolution 1267 (1999) and its successor resolutions; or (ii) designated

25

by that country pursuant to resolution 1373 (2001). ” “ Interpretive Note to Recommendation 6 6. … a) Countries should require all natural

and legal persons with in the country to

freeze, without delay and without prior

notice, the funds or other assets of

designated persons and entities. This

obligation should extend to: all funds or

other assets that are owned or controlled

by the designated person or entity, and

not just those that can be tied to a

particular terrorist act, plot or threat;

those funds or other assets that are wholly

or jointly owned or controlled, directly or

indirectly, by designated persons or

entities; and the funds or other assets

derived or generated from funds or other

assets owned or controlled directly or

indirectly by designated persons or

entities, as well as funds or other assets of

persons and entities acting on behalf of,

or at the direction of, designated persons

or entities.

”

12.1.2 Notification obligation

19 P 12.1.2.: P 12.1.2.: The first sentence was added into P 12.1.2. in compliance with FATF

26

A Relevant Person must immediately notify the AFSA when it becomes aware that it is: (a) carrying on or about to carry on an activity; (b) holding or about to hold money or other assets; or (c) undertaking or about to undertake any other business whether or not arising from or in connection with (a) or (b), for or on behalf of a person, where such carrying on, holding or undertaking constitutes or may constitute a contravention of a relevant sanction or resolution issued by the United Nations Security Council.

A Relevant Person must report to the Committee on financial monitoring of the Ministry of Finance of the Republic of Kazakhstan any assets frozen or actions taken in compliance with the prohibition requirements of the relevant resolutions or sanctions issued by the United Nations Security Council or by the Republic of Kazakhstan, including attempted transactions. A Relevant Person must immediately notify the AFSA when it becomes aware that it is: (a) carrying on or about to carry on an activity; (b) holding or about to hold money or other assets; or (c) undertaking or about to undertake any other business whether or not arising from or in connection with (a) or (b), for or on behalf of a person, where such carrying on, holding or undertaking constitutes or may constitute a contravention of a relevant sanction or resolution issued by the United Nations Security Council.

Recommendation 6 and Interpretive Note to Recomendation 6 (6). “ 6. Targeted financial sanctions related to terrorism and terrorist financing Countries should implement targeted financial sanctions regimes to comply with United Nations Security Council resolutions relating to the prevention and suppression of terrorism and terrorist financing. The resolutions require countries to freeze without delay the funds or other assets of, and to ensure that no funds or other assets are made available, directly or indirectly, to or for the benefit of, any person or entity either (i) designated by, or under the authority of, the United Nations Security Council under Chapter VII of the Charter of the United Nations, including in accordance with resolution 1267 (1999) and its successor resolutions; or (ii) designated by that country pursuant to resolution 1373 (2001). ” “ Interpretive Note to Recommendation 6 6. … Countries should require financial

institutions and DNFBPs to report to

competent authorities any assets frozen

or actions taken in compliance with the

27

prohibition requirements of the relevant

Security Council resolutions, including

attempted transactions, and ensure that

such information is effectively utilised by

the competent authorities. ”

13.7. Reporting

20 13.7.2. Suspicious Activity Controls A Relevant Person must establish and maintain policies, procedures, systems and controls to monitor and detect suspicious activity or transactions in relation to potential money laundering or terrorist financing.

13.7.2. Threshold Transactions Controls A Relevant Person must establish and maintain procedures, systems and controls to monitor, detect and report transactions above defined thresholds in accordance with the AML Law. 13.7.3. Suspicious Activity Controls A Relevant Person must establish and maintain policies, procedures, systems and controls to monitor and detect suspicious activity or transactions in relation to potential money laundering or terrorist financing.

The paragraph on threshold transactions controls was added in compliance with the Article 2 of the AML Law. The numbering of the following paragraph was changed accordingly.

21 13.7.4. Employee reporting to MLRO A Relevant Person must have policies, procedures, systems and controls to ensure that whenever any employee, acting in the ordinary course of his employment, either: (a) knows; (b) suspects; or (c) has reasonable grounds for knowing or suspecting,

13.7.4. Immunity from liability for disclosure of information relating to money laundering transactions The disclosure by a Relevant Person to the competent authorities of information relating to money laundering/terrorist financing is not a breach of the obligation of secrecy or non-disclosure or (where applicable) of

The paragraph on immunity from liability for disclosure of information relating to money laundering transactions was added in compliance with the FATF Recommendation 21 (a). The numbering of the following paragraph was changed accordingly. “

28

that a person is engaged in or attempting money laundering or terrorist financing, that employee promptly notifies the Relevant Person’s MLRO and provides the MLRO with all relevant information within the employee's knowledge.

any enactment by which that obligation is imposed. 13.7.5. Employee reporting to MLRO A Relevant Person must have policies, procedures, systems and controls to ensure that whenever any employee, acting in the ordinary course of his employment, either: (a) knows; (b) suspects; or (c) has reasonable grounds for knowing or suspecting, that a person is engaged in or attempting money laundering or terrorist financing, that employee promptly notifies the Relevant Person’s MLRO and provides the MLRO with all relevant information within the employee's knowledge.

21. Tipping-off and confidentiality Financial institutions, their directors,

officers and employees should be:

(a) protected by law from criminal and

civil liability for breach of any restriction

on disclosure of information imposed by

contract or by any legislative, regulatory

or administrative provision, if they report

their suspicions in good faith to the FIU,

even if they did not know precisely what

the underlying criminal activity was, and

regardless of whether illegal activity

actually occurred; ”

14.1. Training and Awareness

22 14.1.1. Training Obligations A Relevant Person must take appropriate measures to ensure that its employees: (a) are made aware of the law relating to money laundering and terrorist financing; (b) are regularly given training in how to recognise and deal with transactions and other activities which

14.1.1. Training and Other Obligations A Relevant Person must implement screening procedures to ensure high standards when hiring employees. A Relevant Person must take appropriate measures to ensure that its employees: (a) are made aware of the law relating to money laundering and terrorist financing;

The first sentence was added into P 14.1.1. in compliance with the FATF Recommendation 18 and Interpretive Note to Recommendation 18 (1). The name of the paragraph was amended by “and Other” to cover the topic. “ Interpretive Note to Recommendation 18.

29

may be related to money laundering or terrorist financing; (c) understand its policies, procedures, systems and controls related to money laundering and any changes to these; (d) understand the types of activity that may constitute suspicious activity in the context of the business in which an employee is engaged and that may warrant a notification to the MLRO under AML 13.7.3; (e) understand its arrangements regarding the making of a notification to the MLRO under AML 13.7.3; (a) are aware of the prevailing techniques, methods and trends in money laundering relevant to the business of the Relevant Person; (b) understand the risk of tipping-off and how to avoid informing a customer or potential customer that it is or may be the subject of a SAR; (c) understand the roles and responsibilities of employees in combating money laundering, including the identity and responsibility of the Relevant Person’s MLRO and deputy, where applicable; and (d) understand the relevant findings, recommendations, guidance, directives, resolutions, sanctions,

(b) are regularly given training in how to recognise and deal with transactions and other activities which may be related to money laundering or terrorist financing; (c) understand its policies, procedures, systems and controls related to money laundering and any changes to these; (d) understand the types of activity that may constitute suspicious activity in the context of the business in which an employee is engaged and that may warrant a notification to the MLRO under AML 13.7.3; (e) understand its arrangements regarding the making of a notification to the MLRO under AML 13.7.3; (a) are aware of the prevailing techniques, methods and trends in money laundering relevant to the business of the Relevant Person; (b) understand the risk of tipping-off and how to avoid informing a customer or potential customer that it is or may be the subject of a SAR; (c) understand the roles and responsibilities of employees in combating money laundering, including the identity and responsibility of the Relevant Person’s MLRO and deputy, where applicable; and

1. Financial institutions’ programmes against money laundering and terrorist financing should include: (a) the development of internal policies, procedures and controls, including appropriate compliance management arrangements, and adequate screening procedures to ensure high standards when hiring employees; (b) an ongoing employee training programme; and (c) an independent audit function to test the system. ”

30

notices or other conclusions described in Chapter 13.

(d) understand the relevant findings, recommendations, guidance, directives, resolutions, sanctions, notices or other conclusions described in Chapter 13.

14.1.2. Appropriate measures

23 P 14.1.2.: In determining what measures are appropriate under AML 14.1.1 Relevant Person must take account of: (a) the nature of its business; (b) its size; and (c) the nature and extent of the risks of money laundering and terrorist financing to which its business is subject.

P 14.1.2.: In determining what measures are appropriate under AML 14.1.1 Relevant Person must take account of: (a) the nature of its business; (b) its size; and (c) the nature and extent of the risks of money laundering and terrorist financing to which its business is subject. The AFSA may impose additional training requirements in respect of all, or certain, relevant employees of a Relevant Person.

The last sentence was added into P 14.1.2. in purposes of integrating the AIFC AML Regime into the domestic AML Regime. One of the provisions of the article 11 of the AML Law explicitly stipulates the obligation of training and awareness. Requirements to such training and awareness shall be approved jointly by the national Financial Intelligence Unit (an authorized state body in AML/CTF) and Regulatory body (read AFSA). Therefore, it is reasonable to give the AFSA considered rights on imposing additional requirements on training and awareness if the Financial Intelligence Unit insists so. “ Article 11. Maintenance of internal control by reporting entities. … 8. Requirements to reporting entities on training and awareness of employees shall be approved by the authorised body

31

in concurrence with the relevant state bodies. ”